evilquest | 3ae5d07b6171844322ee47ad4d904d530ebbcc54194f7005ade9249657804bfb | Triage

Submit
Reports

Overview

overview

Static

static

08b0fbf32d...kes118

macos-10.15-amd64

Sharing

General

Target

08b0fbf32de4782ea4916af086640451_JaffaCakes118
Size

168KB
Sample

240430-bmrkrsgd7v
MD5

08b0fbf32de4782ea4916af086640451
SHA1

4625e151203f8cfbeec33a5cae35556f994220f5
SHA256

3ae5d07b6171844322ee47ad4d904d530ebbcc54194f7005ade9249657804bfb
SHA512

64cb22ac7e62057e53cc628164103b00d066d9fa74e96d33b9412b9653c8401311985f67645e9ceabdc4719ffddb08c872835b0082c37047065ff93301df2190
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Xmv6V0:5SeOQdaZNxtk8cqhSxvHY9Xu

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

08b0fbf32de4782ea4916af086640451_JaffaCakes118

Resource

macos-20240410-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  08b0fbf32de4782ea4916af086640451_JaffaCakes118
- Size
  
  168KB
- MD5
  
  08b0fbf32de4782ea4916af086640451
- SHA1
  
  4625e151203f8cfbeec33a5cae35556f994220f5
- SHA256
  
  3ae5d07b6171844322ee47ad4d904d530ebbcc54194f7005ade9249657804bfb
- SHA512
  
  64cb22ac7e62057e53cc628164103b00d066d9fa74e96d33b9412b9653c8401311985f67645e9ceabdc4719ffddb08c872835b0082c37047065ff93301df2190
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Xmv6V0:5SeOQdaZNxtk8cqhSxvHY9Xu
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy